configuring-pfsense-firewall-rules
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
What it does
This agent helps configure the rules of a firewall called pfSense. It organizes how data enters and leaves your network, separating devices into groups (like internal network, guests, etc.) for better security.
When to use it
- ✓When setting up a new firewall to protect your network.
- ✓When you want to allow access to a specific service within your network (e.g., a website).
- ✓When creating separate networks for guests or 'smart home' devices.
Example of what to ask your AI
“Configure the pfSense firewall to allow the guest network to access only the internet, blocking access to other internal networks.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The agent follows a step-by-step process. First, it sets up network connections and separate networks (VLANs). Then, it defines which devices can communicate with which, creating specific rules for each type of traffic.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-pfsense-firewall-rulesOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/configuring-pfsense-firewall-rules/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Configuring pfSense Firewall Rules
When to Use
- Deploying a perimeter or internal firewall to segment and protect network zones (DMZ, internal, guest, IoT)
- Creating granular access control rules to restrict traffic between VLANs and network segments
- Configuring NAT rules for port forwarding to internal services exposed to the internet
- Setting up site-to-site or remote access VPN tunnels using IPsec or OpenVPN
- Implementing traffic shaping and bandwidth management for quality-of-service requirements
Do not use as a substitute for host-based firewalls on individual systems, for SSL/TLS deep packet inspection without dedicated hardware acceleration, or as the sole security control without complementary IDS/IPS.
Prerequisites
- pfSense 2.7+ installed on dedicated hardware or virtual machine with at least two network interfaces
- Access to the pfSense WebConfigurator (default: https://192.168.1.1)
- Network topology diagram showing all interfaces, VLANs, and desired traffic flow
- DNS and DHCP configuration planned for each network zone
- Understanding of TCP/IP, NAT, and stateful firewall concepts
Workflow
Step 1: Configure Network Interfaces and VLANs
Access the pfSense WebConfigurator and define interfaces:
Navigate: Interfaces > Assignments
WAN Interface (igb0):
- Type: DHCP or Static IP from ISP
- Block private networks: Enabled
- Block bogon networks: Enabled
LAN Interface (igb1):
- IPv4: 10.10.1.1/24
- Description: CORPORATE_LAN
Create VLANs:
Navigate: Interfaces > VLANs > Add
- VLAN 10 on igb1: DMZ (10.10.10.1/24)
- VLAN 20 on igb1: SERVERS (10.10.20.1/24)
- VLAN 30 on igb1: GUEST (10.10.30.1/24)
- VLAN 40 on igb1: IOT (10.10.40.1/24)
Assign VLANs:
Navigate: Interfaces > Assignments > Add each VLAN
Enable each interface and assign the gateway IP
Step 2: Configure DHCP and DNS for Each Zone
Navigate: Services > DHCP Server
CORPORATE_LAN (10.10.1.0/24):
Range: 10.10.1.100 - 10.10.1.200
DNS: 10.10.20.10 (internal DNS server)
Gateway: 10.10.1.1
DMZ (10.10.10.0/24):
Range: 10.10.10.100 - 10.10.10.200
DNS: 10.10.20.10
Gateway: 10.10.10.1
GUEST (10.10.30.0/24):
Range: 10.10.30.100 - 10.10.30.200
DNS: 1.1.1.1, 8.8.8.8 (public DNS only)
Gateway: 10.10.30.1
Navigate: Services > DNS Resolver
Enable DNS Resolver on all interfaces except GUEST
Enable DNSSEC
Configure forwarding to upstream DNS servers
Step 3: Create Firewall Rule Aliases
Navigate: Firewall > Aliases
RFC1918_Networks:
Type: Network
Values: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
WebPorts:
Type: Port
Values: 80, 443
ManagementPorts:
Type: Port
Values: 22, 3389, 5900
CriticalServers:
Type: Host
Values: 10.10.20.10, 10.10.20.11, 10.10.20.12
BlockedCountries:
Type: URL Table
URL: https://www.ipdeny.com/ipblocks/data/aggregated/cn-aggregated.zone
Update: 24 hours
Step 4: Implement Firewall Rules by Zone
Navigate: Firewall > Rules
=== WAN Rules ===
# Block all inbound by default (implicit deny)
# Allow established/related traffic (automatic in pfSense stateful mode)
# Allow inbound to DMZ web server (via NAT)
Action: Pass | Interface: WAN | Protocol: TCP
Source: any | Destination: WAN Address | Port: 80, 443
Description: Allow HTTP/HTTPS to DMZ web server
=== LAN Rules ===
# Allow LAN to access internal servers
Action: Pass | Interface: LAN | Protocol: TCP
Source: LAN net | Destination: SERVERS net | Port: WebPorts, 3306, 5432
Description: Allow LAN to internal web and database servers
# Allow LAN to internet
Action: Pass | Interface: LAN | Protocol: any
Source: LAN net | Destination: ! RFC1918_Networks
Description: Allow LAN to internet (block inter-VLAN via RFC1918 exclusion)
# Block LAN to IoT (explicit deny before implicit allow)
Action: Block | Interface: LAN | Protocol: any
Source: LAN net | Destination: IOT net
Description: Block direct LAN to IoT communication
=== DMZ Rules ===
# Allow DMZ web servers to query internal DNS
Action: Pass | Interface: DMZ | Protocol: TCP/UDP
Source: DMZ net | Destination: 10.10.20.10 | Port: 53
Description: Allow DMZ DNS queries to internal resolver
# Allow DMZ to internet for updates only
Action: Pass | Interface: DMZ | Protocol: TCP
Source: DMZ net | Destination: any | Port: 80, 443
Description: Allow DMZ outbound HTTP/HTTPS for updates
# Block all other DMZ traffic
Action: Block | Interface: DMZ | Protocol: any
Source: DMZ net | Destination: any
…
FAQ
What is pfSense?
pfSense is free software that turns a computer into a powerful firewall and router to protect and manage your network.
What are VLANs?
VLANs (Virtual Local Area Networks) are like creating sub-networks within your main network to separate different types of devices or users, enhancing security.
What is NAT?
NAT (Network Address Translation) is a technique that allows multiple devices on a private network to share a single public IP address to access the internet, and it's also used to redirect traffic to specific services.
Details
Original description by the author
Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic between zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter or internal firewall, setting up port-forwarding NAT, configuring site-to-site or remote-access VPNs, or applying QoS/bandwidth policies. '
Popularity
- GitHub stars
- 35k
- Ranking position
- #5601
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
bun-runtime
Has your agent use Bun to run, organize, and test code. It helps choose Bun over other tools and migrate existing projects.
affaan-m/ECC
database-migrations
Helps your agent make safe changes to databases. It ensures changes can be undone and minimizes downtime.
affaan-m/ECC
deployment-patterns
Sets up deployment and CI/CD workflows, containerization, and rollback strategies to ensure safe releases.
affaan-m/ECC